How severe is CVE-2025-8148?

CVE-2025-8148 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-8148 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-8148?

CVE-2025-8148 affects Fortra Goanywhere Managed File Transfer. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-8148?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-8148 have an EU (EUVD) identifier?

Yes. CVE-2025-8148 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-201495.

When was CVE-2025-8148 published?

CVE-2025-8148 was published on 2025-12-05 and last updated on 2026-06-17.

CVE-2025-8148

CVE-2025-8148 is a medium-severity vulnerability in Fortra Goanywhere Managed File Transfer with a CVSS 3.x base score of 4.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-732.

Key facts

Severity: Medium (CVSS 3.x base score 4.2)
EPSS exploit prediction: 0% (5th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-201495
Weakness: CWE-732
Affected product: Fortra Goanywhere Managed File Transfer
Published: 2025-12-05
Last modified: 2026-06-17

Description

An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.

Frequently asked questions

What is CVE-2025-8148?: An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
How severe is CVE-2025-8148?: CVE-2025-8148 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-8148 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-8148?: CVE-2025-8148 affects Fortra Goanywhere Managed File Transfer. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-8148?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-8148 have an EU (EUVD) identifier?: Yes. CVE-2025-8148 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-201495.
When was CVE-2025-8148 published?: CVE-2025-8148 was published on 2025-12-05 and last updated on 2026-06-17.

References

https://www.fortra.com/security/advisories/product-security/fi-2025-013

Affected products (1)

cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*

More vulnerabilities in Fortra Goanywhere Managed File Transfer

CVE-2025-10035 — Critical (CVSS 10.0): A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged…
CVE-2024-0204 — Critical (CVSS 9.8): Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via…
CVE-2025-14362 — High (CVSS 7.3): The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User…
CVE-2023-0669 — High (CVSS 7.2): Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the…
CVE-2026-1089 — Medium (CVSS 6.5): User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS…
CVE-2024-25157 — Medium (CVSS 6.5): An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent…

All CVEs affecting Fortra Goanywhere Managed File Transfer →

Other CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities

CVE-2026-9508 — Critical (CVSS 10.0): Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow…
CVE-2025-14988 — Critical (CVSS 10.0): A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain…
CVE-2025-69426 — Critical (CVSS 10.0): The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating…
CVE-2025-12004 — Critical (CVSS 10.0): Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown…
CVE-2014-125121 — Critical (CVSS 10.0): Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation…
CVE-2025-46093 — Critical (CVSS 9.9): LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to…

Browse all CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities →